@blamejs/core 0.15.11 → 0.15.13

package/lib/network-byte-quota.js

@@ -39,6 +39,7 @@
  */
 
 var C = require("./constants");
+var boundedMap = require("./bounded-map");
 var defineClass = require("./framework-error").defineClass;
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
@@ -79,9 +80,7 @@ function _slideAndSum(entry, nowHour) {
 function _memoryBackend() {
   var store = new Map();
   function _get(key) {
-    var entry = store.get(key);
-    if (!entry) { entry = _newEntry(); store.set(key, entry); }
-    return entry;
+    return boundedMap.getOrInsert(store, key, function () { return _newEntry(); });
   }
   return {
     async total(key, nowMs) {
@@ -172,27 +171,14 @@ function create(opts) {
   validateOpts(opts, ["bytesPerDay", "cache", "audit", "now"], "network.byteQuota");
   _requirePositiveBytes("bytesPerDay", opts.bytesPerDay);
   var bytesPerDay = opts.bytesPerDay;
-  var auditOn = opts.audit !== false;
   var now = typeof opts.now === "function" ? opts.now : function () { return Date.now(); };
   var backend = opts.cache && typeof opts.cache.get === "function"
     ? _cacheBackend(opts.cache)
     : _memoryBackend();
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   "network.byte_quota." + action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent — audit is best-effort */ }
-  }
+  var _emitAudit = audit().namespaced("network.byte_quota", opts.audit);
 
-  function _emitMetric(verb, n, labels) {
-    try { observability().safeEvent("network.byte_quota." + verb, n || 1, labels || {}); }
-    catch (_e) { /* drop-silent */ }
-  }
+  var _emitMetric = observability().namespaced("network.byte_quota");
 
   // check(key, bytes) — preflight without mutation. Returns
   //   { allowed, total, remaining, quota, retryAfterSec, degraded }

package/lib/network-dane.js

@@ -31,6 +31,7 @@
 
 var nodeCrypto = require("node:crypto");
 var bCrypto = require("./crypto");
+var safeBuffer = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -44,12 +45,13 @@ var SELECTORS = { 0: "Cert", 1: "SPKI" };
 // refused rather than guessed.
 var MATCHING = { 0: null, 1: "sha256", 2: "sha512" };
 
-function _bytes(x, what) {
-  if (Buffer.isBuffer(x)) return x;
-  if (x instanceof Uint8Array) return Buffer.from(x);
-  if (typeof x === "string") return Buffer.from(x, "hex");
-  throw new DaneError("dane/bad-bytes", "dane: " + what + " must be a Buffer / Uint8Array / hex string");
-}
+var _bytes = safeBuffer.makeByteCoercer({
+  errorClass:    DaneError,
+  typeCode:      "dane/bad-bytes",
+  messagePrefix: "dane: ",
+  messageSuffix: " must be a Buffer / Uint8Array / hex string",
+  encoding:      "hex",
+});
 
 function _selectedData(x509, selector) {
   if (selector === 0) return Buffer.from(x509.raw);                                   // full certificate DER

package/lib/network-dns-resolver.js

@@ -188,7 +188,9 @@ function create(opts) {
   var serveStale  = opts.serveStale === false ? 0 :
                     typeof opts.serveStale === "number" ? opts.serveStale : DEFAULT_STALE_WINDOW;
   var transport   = opts.transport || _defaultTransport();
-  var auditImpl   = opts.audit || audit();
+  // Audit goes to the operator-supplied sink (opts.audit) when present, else the
+  // framework chain — b.audit.namespaced no-ops if the sink has no safeEmit.
+  var _baseAudit  = audit().namespaced("network.dns.resolver", { sink: opts.audit });
 
   if (typeof transport.lookup !== "function") {
     throw new ResolverError("resolver/bad-transport",
@@ -238,11 +240,7 @@ function create(opts) {
   }
 
   function _safeEmit(action, metadata) {
-    try {
-      if (auditImpl && typeof auditImpl.safeEmit === "function") {
-        auditImpl.safeEmit({ action: "network.dns.resolver." + action, outcome: "success", metadata: metadata });
-      }
-    } catch (_e) { /* audit drop-silent per validation tier policy */ }
+    _baseAudit(action, "success", metadata);
   }
 
   async function query(name, type, qopts) {
@@ -526,8 +524,101 @@ function _minTtl(rrs) {
   return min === Infinity ? 0 : min;
 }
 
+// _sharedTxtResolver — one process-wide validating resolver (with its TTL
+// cache) shared by every email-auth policy TXT lookup, instead of each module
+// constructing its own (or reaching for plaintext system DNS).
+var _sharedResolver = null;
+function _sharedTxtResolver() {
+  if (!_sharedResolver) _sharedResolver = create();
+  return _sharedResolver;
+}
+
+/**
+ * @primitive  b.network.dns.resolver.resolveTxt
+ * @signature  b.network.dns.resolver.resolveTxt(qname, dnsLookup?, resolver?)
+ * @since      0.15.13
+ * @status     stable
+ * @related    b.network.dns.resolver.safeResolveTxt, b.network.dns.resolver.create
+ *
+ * Resolve TXT records for `qname` via the operator's `dnsLookup(qname, "TXT")`
+ * override when supplied, otherwise the framework's shared validating
+ * (DoH / DoT / system, DNSSEC-checked) resolver — normalized to the
+ * `string[][]` shape `dnsPromises.resolveTxt` returns. Throws an `ENODATA`
+ * Error when no TXT records exist.
+ *
+ * This is the secure DNS path for every email-auth policy lookup (DMARC / DKIM /
+ * ARC / BIMI / MTA-STS / TLS-RPT). Plaintext system DNS (`dnsPromises.resolveTxt`)
+ * is spoofable — DNS cache-poisoning / Kaminsky-class — and must NOT be used for
+ * records a downgrade or redirect would exploit.
+ *
+ * Pass `resolver` (a `b.network.dns.resolver.create()` instance) to reshape TXT
+ * records off a caller-owned resolver instead of the shared one — the mail-auth
+ * and mail-dkim modules use this so their TXT lookups share the same resolver
+ * (and cache) they use for A / MX / PTR, instead of each re-rolling the reshape.
+ *
+ * @example
+ *   var rrs = await b.network.dns.resolver.resolveTxt("_dmarc.example.com");
+ *   // → [ ["v=DMARC1; p=reject"] ]
+ */
+async function resolveTxt(qname, dnsLookup, resolver) {
+  if (dnsLookup) return dnsLookup(qname, "TXT");
+  var r = await (resolver || _sharedTxtResolver()).queryTxt(qname);
+  var out = [];
+  for (var i = 0; i < r.rrs.length; i += 1) {
+    var rr = r.rrs[i];
+    if (rr && rr.type === 16) {                                          // IANA DNS qtype TXT
+      out.push(Array.isArray(rr.decoded) ? rr.decoded : [String(rr.decoded)]);
+    }
+  }
+  if (out.length === 0) {
+    var err = new Error("no TXT records for " + qname);
+    err.code = "ENODATA";
+    throw err;
+  }
+  return out;
+}
+
+/**
+ * @primitive  b.network.dns.resolver.safeResolveTxt
+ * @signature  b.network.dns.resolver.safeResolveTxt(qname, opts?)
+ * @since      0.15.13
+ * @status     stable
+ * @related    b.network.dns.resolver.resolveTxt
+ *
+ * `resolveTxt` wrapped with the email-auth policy-fetch convention: a domain
+ * with no record (ENOTFOUND / ENODATA) returns `null` (absence is not an
+ * error); any other failure throws the caller's typed error via
+ * `errorFactory(code, message)` so each protocol keeps its own error class.
+ * The same secure resolver path as `resolveTxt` — never plaintext system DNS.
+ *
+ * @opts
+ *   dnsLookup:    function,   // operator override (qname, "TXT") => string[][]
+ *   errorFactory: function,   // (code, message) => Error, thrown on non-absence failures
+ *   code:         string,     // error code passed to errorFactory
+ *
+ * @example
+ *   var rrs = await b.network.dns.resolver.safeResolveTxt("_mta-sts.example.com", {
+ *     errorFactory: function (code, msg) { return new SmtpPolicyError(code, msg); },
+ *     code: "smtp/mta-sts-txt-lookup-failed",
+ *   });
+ *   if (rrs === null) return null;   // no MTA-STS record published
+ */
+async function safeResolveTxt(qname, opts) {
+  opts = opts || {};
+  try {
+    return await resolveTxt(qname, opts.dnsLookup);
+  } catch (e) {
+    if (e && (e.code === "ENOTFOUND" || e.code === "ENODATA")) return null;
+    var msg = "TXT lookup for " + qname + " failed: " + ((e && e.message) || String(e));
+    if (typeof opts.errorFactory === "function") throw opts.errorFactory(opts.code, msg);
+    throw e;
+  }
+}
+
 module.exports = {
   create:         create,
+  resolveTxt:     resolveTxt,
+  safeResolveTxt: safeResolveTxt,
   ResolverError:  ResolverError,
   QTYPE_BY_NAME:  QTYPE_BY_NAME,
 };

package/lib/network-dns.js

@@ -149,7 +149,7 @@ function setServers(serverList) {
     throw new DnsError("dns/setservers-failed", "dns.setServers failed: " + e.message);
   }
   _clearCache();
-  _emitObs("network.dns.servers.set", { count: serverList.length });
+  observability().safeEvent("network.dns.servers.set", 1, { count: serverList.length });
 }
 
 function getServers() {
@@ -169,7 +169,7 @@ function setResultOrder(order) {
     try { dns.setDefaultResultOrder(order); } catch (_e) { /* node may not support setter on this version — best-effort */ }
   }
   _clearCache();
-  _emitObs("network.dns.result_order.set", { order: order });
+  observability().safeEvent("network.dns.result_order.set", 1, { order: order });
 }
 
 function setFamily(fam) {
@@ -215,7 +215,7 @@ function useSystemResolver() {
   STATE.systemResolver = true;
   _resetDotPool();
   _clearCache();
-  _emitObs("network.dns.system_resolver.set", {});
+  observability().safeEvent("network.dns.system_resolver.set", 1, {});
 }
 
 function useDnsOverHttps(opts) {
@@ -246,7 +246,7 @@ function useDnsOverHttps(opts) {
   }
   STATE.doh = { url: url, method: method, ca: opts.ca || null };
   _clearCache();
-  _emitObs("network.dns.doh.set", { url: url, method: method || "auto" });
+  observability().safeEvent("network.dns.doh.set", 1, { url: url, method: method || "auto" });
 }
 
 function useDnsOverTls(opts) {
@@ -267,7 +267,7 @@ function useDnsOverTls(opts) {
   };
   _resetDotPool();
   _clearCache();
-  _emitObs("network.dns.dot.set", { host: STATE.dot.host, port: STATE.dot.port });
+  observability().safeEvent("network.dns.dot.set", 1, { host: STATE.dot.host, port: STATE.dot.port });
 }
 
 function _withTimeout(promise, ms, host) {
@@ -1178,13 +1178,13 @@ async function _querySvcbLike(host, qtype, opts) {
     throw new DnsError("dns/bad-transport",
       "dns.querySvcb: transport must be 'doh' | 'dot' | 'system' | undefined");
   }
-  _emitObs("network.dns.svcb.requested", { qtype: qtype, transport: opts.transport || "auto" });
+  observability().safeEvent("network.dns.svcb.requested", 1, { qtype: qtype, transport: opts.transport || "auto" });
   var startMs = _now();
   var reply;
   try {
     reply = await _rawQuery(host, qtype, opts.transport);
   } catch (e) {
-    _emitObs("network.dns.svcb.failure", {
+    observability().safeEvent("network.dns.svcb.failure", 1, {
       latencyMs: _now() - startMs,
       code:      e.code || "unknown",
     });
@@ -1198,7 +1198,7 @@ async function _querySvcbLike(host, qtype, opts) {
     records.push(_parseSvcbRdata(decoded.msg, ans.rdataOff, ans.rdlen));
   }
   records.sort(function (a, b) { return a.priority - b.priority; });
-  _emitObs("network.dns.svcb.success", {
+  observability().safeEvent("network.dns.svcb.success", 1, {
     latencyMs: _now() - startMs,
     count:     records.length,
     qtype:     qtype,
@@ -1322,7 +1322,7 @@ async function discoverEncrypted(opts) {
   try {
     records = await _querySvcbLike(name, DNS_QTYPE_SVCB, { transport: transport });
   } catch (e) {
-    _emitObs("network.dns.ddr.failure", {
+    observability().safeEvent("network.dns.ddr.failure", 1, {
       latencyMs: _now() - startMs,
       code:      e.code || "unknown",
     });
@@ -1333,7 +1333,7 @@ async function discoverEncrypted(opts) {
     throw e;
   }
   if (records.length === 0) {
-    _emitObs("network.dns.ddr.empty", { latencyMs: _now() - startMs });
+    observability().safeEvent("network.dns.ddr.empty", 1, { latencyMs: _now() - startMs });
     throw new DnsError("dns/ddr-not-discovered",
       "dns.discoverEncrypted: resolver returned empty DDR record set at " + name);
   }
@@ -1364,7 +1364,7 @@ async function discoverEncrypted(opts) {
     throw new DnsError("dns/ddr-not-discovered",
       "dns.discoverEncrypted: DDR records present but none advertised a recognized transport (alpn=dot/h2/h3)");
   }
-  _emitObs("network.dns.ddr.success", {
+  observability().safeEvent("network.dns.ddr.success", 1, {
     latencyMs: _now() - startMs,
     count:     resolvers.length,
   });
@@ -1454,7 +1454,7 @@ function useDesignatedResolvers(list) {
         });
       }
       _designatedResolvers = validated.slice();
-      _emitObs("network.dns.dnr.set", {
+      observability().safeEvent("network.dns.dnr.set", 1, {
         count:     validated.length,
         active:    j,
         transport: v.transport,
@@ -1462,7 +1462,7 @@ function useDesignatedResolvers(list) {
       return { active: j, count: validated.length };
     } catch (e) {
       lastErr = e;
-      _emitObs("network.dns.dnr.entry_failed", {
+      observability().safeEvent("network.dns.dnr.entry_failed", 1, {
         index:     j,
         transport: v.transport,
         code:      e.code || "unknown",
@@ -1511,7 +1511,7 @@ async function lookup(host, opts) {
     if (cached.error) throw cached.error;
     return opts.all ? cached.value : cached.value[0];
   }
-  _emitObs("network.dns.lookup.requested", { family: cacheKey });
+  observability().safeEvent("network.dns.lookup.requested", 1, { family: cacheKey });
   var startMs = _now();
   // Resolve secure-DNS default on first use. Idempotent.
   _ensureSecureDefault();
@@ -1546,11 +1546,11 @@ async function lookup(host, opts) {
       throw new DnsError("dns/no-result", "dns lookup of '" + host + "' returned no addresses");
     }
     _cachePutPositive(host, cacheKey, normalized);
-    _emitObs("network.dns.lookup.success", { latencyMs: _now() - startMs, count: normalized.length });
+    observability().safeEvent("network.dns.lookup.success", 1, { latencyMs: _now() - startMs, count: normalized.length });
     return opts.all ? normalized : normalized[0];
   } catch (e) {
     _cachePutNegative(host, cacheKey, e);
-    _emitObs("network.dns.lookup.failure", { latencyMs: _now() - startMs, code: e.code || "unknown" });
+    observability().safeEvent("network.dns.lookup.failure", 1, { latencyMs: _now() - startMs, code: e.code || "unknown" });
     throw e;
   }
 }
@@ -1571,7 +1571,7 @@ async function _resolveProtocol(host, family, opts) {
     throw new DnsError("dns/bad-transport",
       "dns.resolve" + family + ": transport must be 'doh' | 'dot' | 'system' | undefined");
   }
-  _emitObs("network.dns.resolve.requested", { family: family, transport: opts.transport || "auto" });
+  observability().safeEvent("network.dns.resolve.requested", 1, { family: family, transport: opts.transport || "auto" });
   var startMs = _now();
   try {
     var addrs;
@@ -1597,10 +1597,10 @@ async function _resolveProtocol(host, family, opts) {
     if (normalized.length === 0) {
       throw new DnsError("dns/no-result", "dns.resolve" + family + " of '" + host + "' returned no addresses");
     }
-    _emitObs("network.dns.resolve.success", { family: family, latencyMs: _now() - startMs, count: normalized.length });
+    observability().safeEvent("network.dns.resolve.success", 1, { family: family, latencyMs: _now() - startMs, count: normalized.length });
     return normalized;
   } catch (e) {
-    _emitObs("network.dns.resolve.failure", { family: family, latencyMs: _now() - startMs, code: e.code || "unknown" });
+    observability().safeEvent("network.dns.resolve.failure", 1, { family: family, latencyMs: _now() - startMs, code: e.code || "unknown" });
     if (e instanceof DnsError) throw e;
     throw new DnsError("dns/resolve-failed",
       "dns.resolve" + family + " of '" + host + "' failed: " + (e.message || String(e)));
@@ -1643,16 +1643,16 @@ async function reverse(ip) {
     throw new DnsError("dns/bad-ip",
       "dns.reverse: '" + ip + "' is not a valid IPv4 or IPv6 address");
   }
-  _emitObs("network.dns.reverse.requested", { family: net.isIPv6(ip) ? 6 : 4 });
+  observability().safeEvent("network.dns.reverse.requested", 1, { family: net.isIPv6(ip) ? 6 : 4 });
   var startMs = _now();
   try {
     var ptrs = await _withTimeout(dnsPromises.reverse(ip), STATE.lookupTimeoutMs, ip);
-    _emitObs("network.dns.reverse.success", {
+    observability().safeEvent("network.dns.reverse.success", 1, {
       latencyMs: _now() - startMs, count: Array.isArray(ptrs) ? ptrs.length : 0,
     });
     return Array.isArray(ptrs) ? ptrs : [];
   } catch (e) {
-    _emitObs("network.dns.reverse.failure", {
+    observability().safeEvent("network.dns.reverse.failure", 1, {
       latencyMs: _now() - startMs, code: e.code || "unknown",
     });
     if (e instanceof DnsError) throw e;
@@ -1674,10 +1674,6 @@ function nodeLookup(host, options, callback) {
   );
 }
 
-function _emitObs(name, fields) {
-  try { observability().emit(name, fields || {}); } catch (_e) { /* obs best-effort */ }
-}
-
 function _stateForTest() { return STATE; }
 function _resetForTest() {
   STATE.servers = null; STATE.resultOrder = null; STATE.family = 0;

package/lib/network-dnssec.js

@@ -46,6 +46,7 @@
 
 var nodeCrypto = require("node:crypto");
 var bCrypto = require("./crypto");
+var safeBuffer = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -79,11 +80,14 @@ var TYPE_NUM = {
   SMIMEA: 53, CDS: 59, CDNSKEY: 60, OPENPGPKEY: 61, CAA: 257, HINFO: 13,
 };
 
-function _bytes(x, what) {
-  if (Buffer.isBuffer(x)) return x;
-  if (x instanceof Uint8Array) return Buffer.from(x);
-  throw new DnssecError("dnssec/bad-bytes", "dnssec: " + what + " must be a Buffer");
-}
+// DNSSEC wire data is bytes, never text (allowString:false).
+var _bytes = safeBuffer.makeByteCoercer({
+  errorClass:    DnssecError,
+  typeCode:      "dnssec/bad-bytes",
+  messagePrefix: "dnssec: ",
+  messageSuffix: " must be a Buffer",
+  allowString:   false,
+});
 
 // Canonical wire form of a domain name (RFC 4034 §6.2): each label
 // length-prefixed, ASCII lowercased, terminated by the root label.
@@ -157,8 +161,11 @@ function _dnskeyToKey(algId, publicKey) {
   return _jwkKey({ kty: "OKP", crv: "Ed25519", x: pk.toString("base64url") });
 }
 function _jwkKey(jwk) {
-  try { return nodeCrypto.createPublicKey({ key: jwk, format: "jwk" }); }
-  catch (e) { throw new DnssecError("dnssec/bad-key", "dnssec: could not import DNSKEY: " + ((e && e.message) || e)); }
+  return bCrypto.importPublicJwk(jwk, {
+    errorClass:    DnssecError,
+    code:          "dnssec/bad-key",
+    messagePrefix: "dnssec: could not import DNSKEY: ",
+  });
 }
 
 /**
@@ -284,15 +291,8 @@ function verifyRrset(opts) {
   }
 
   // Validity window (fail closed on a bad opts.at).
-  var atMs;
-  if (opts.at !== undefined && opts.at !== null) {
-    if (!(opts.at instanceof Date) || !isFinite(opts.at.getTime())) {
-      throw new DnssecError("dnssec/bad-at", "dnssec.verifyRrset: opts.at must be a valid Date");
-    }
-    atMs = opts.at.getTime();
-  } else {
-    atMs = Date.now();
-  }
+  validateOpts.optionalDate(opts.at, "dnssec.verifyRrset: opts.at", DnssecError, "dnssec/bad-at");
+  var atMs = (opts.at !== undefined && opts.at !== null) ? opts.at.getTime() : Date.now();
   var nowSec = Math.floor(atMs / 1000);
   if (nowSec < (rrsig.inception >>> 0)) throw new DnssecError("dnssec/not-yet-valid", "dnssec.verifyRrset: RRSIG inception is in the future");
   if (nowSec > (rrsig.expiration >>> 0)) throw new DnssecError("dnssec/expired", "dnssec.verifyRrset: RRSIG has expired");

package/lib/network-heartbeat.js

@@ -5,6 +5,7 @@ var net = require("node:net");
 var C = require("./constants");
 var validateOpts = require("./validate-opts");
 var lazyRequire = require("./lazy-require");
+var boundedMap = require("./bounded-map");
 var { defineClass } = require("./framework-error");
 
 var HeartbeatError = defineClass("HeartbeatError", { alwaysPermanent: true });
@@ -198,9 +199,9 @@ function start(opts) {
   var started = [];
   for (var j = 0; j < opts.targets.length; j++) {
     var t = opts.targets[j];
-    if (TARGETS.has(t.name)) {
+    boundedMap.requireAbsent(TARGETS, t.name, function () {
       throw new HeartbeatError("heartbeat/duplicate", "heartbeat target '" + t.name + "' already started");
-    }
+    });
     var entry = {
       target:              t,
       intervalMs:          t.intervalMs || DEFAULT_INTERVAL_MS,
@@ -259,7 +260,7 @@ function statuses() {
 
 function _emitObsProbe(entry, result) {
   try {
-    observability().emit("network.heartbeat.probe", {
+    observability().safeEvent("network.heartbeat.probe", 1, {
       name:      entry.target.name,
       type:      entry.target.type,
       ok:        result.ok,
@@ -381,7 +382,7 @@ function passive(opts) {
 
 function _emitObsPong(state) {
   try {
-    observability().emit("network.heartbeat.passive.pong", {
+    observability().safeEvent("network.heartbeat.passive.pong", 1, {
       pongCount:  state.pongCount,
       timeoutMs:  state.timeoutMs,
     });
@@ -390,7 +391,7 @@ function _emitObsPong(state) {
 
 function _emitObsTimeout(state) {
   try {
-    observability().emit("network.heartbeat.passive.timeout", {
+    observability().safeEvent("network.heartbeat.passive.timeout", 1, {
       pongCount:  state.pongCount,
       lastPongMs: state.lastPongMs,
       timeoutMs:  state.timeoutMs,

package/lib/network-proxy.js

@@ -70,7 +70,7 @@ function set(opts) {
   if (opts.no !== undefined)    STATE.noProxy = _parseNoProxy(opts.no);
   if (opts.auth !== undefined)  STATE.auth = opts.auth ? _parseAuth(opts.auth) : null;
   STATE.agentCache.clear();
-  _emitObs("network.proxy.set", {
+  observability().safeEvent("network.proxy.set", 1, {
     httpSet:  !!STATE.http,
     httpsSet: !!STATE.https,
     noProxyCount: STATE.noProxy.length,
@@ -93,7 +93,7 @@ function fromEnv(envObj) {
   if (authEnv)    { STATE.auth = _parseAuth(authEnv);         changed = true; }
   if (changed) {
     STATE.agentCache.clear();
-    _emitObs("network.proxy.from_env", {
+    observability().safeEvent("network.proxy.from_env", 1, {
       httpSet:  !!STATE.http,
       httpsSet: !!STATE.https,
       noProxyCount: STATE.noProxy.length,
@@ -255,7 +255,7 @@ function agentFor(targetUrl) {
     };
   }
   STATE.agentCache.set(key, agent);
-  _emitObs("network.proxy.agent.created", { protocol: u.protocol });
+  observability().safeEvent("network.proxy.agent.created", 1, { protocol: u.protocol });
   return agent;
 }
 
@@ -268,10 +268,6 @@ function snapshot() {
   };
 }
 
-function _emitObs(name, fields) {
-  try { observability().emit(name, fields || {}); } catch (_e) { /* obs best-effort */ }
-}
-
 function _resetForTest() {
   STATE.http = null; STATE.https = null; STATE.noProxy = []; STATE.auth = null;
   STATE.agentCache.clear();

package/lib/network-smtp-policy.js

@@ -57,7 +57,9 @@ var nodeCrypto = require("node:crypto");
 var zlib = require("node:zlib");
 var asn1 = require("./asn1-der");
 var lazyRequire = require("./lazy-require");
+var networkDnsResolver = lazyRequire(function () { return require("./network-dns-resolver"); });
 var validateOpts = require("./validate-opts");
+var structuredFields = require("./structured-fields");
 var bCrypto = require("./crypto");
 var safeUrl = require("./safe-url");
 var safeJson = require("./safe-json");
@@ -91,14 +93,12 @@ function _parseStsPolicy(text) {
       "MTA-STS policy text is empty");
   }
   var policy = { version: null, mode: null, mx: [], max_age: null };
-  var lines = text.split(/\r?\n/);
-  for (var i = 0; i < lines.length; i += 1) {
-    var line = lines[i].trim();
-    if (line.length === 0) continue;
-    var colonAt = line.indexOf(":");
-    if (colonAt === -1) continue;
-    var key = line.slice(0, colonAt).trim().toLowerCase();
-    var val = line.slice(colonAt + 1).trim();
+  // RFC 8461 §3.2 — newline-separated `key: value` lines, no quoted-string;
+  // mx may repeat, so iterate pairs (a last-wins map would drop hosts).
+  var pairs = structuredFields.parseTagList(text, { sep: /\r?\n/, kvSep: ":" });
+  for (var i = 0; i < pairs.length; i += 1) {
+    var key = pairs[i][0];
+    var val = pairs[i][1];
     if (key === "version") policy.version = val;
     else if (key === "mode") policy.mode = val.toLowerCase();
     else if (key === "mx") policy.mx.push(val.toLowerCase());
@@ -123,17 +123,13 @@ function _parseStsPolicy(text) {
 // cached policy forever (defeating operator rotation), and would also
 // fetch policies from domains that don't publish one.
 async function _fetchStsTxt(domain, dnsLookup) {
-  var records;
-  try {
-    records = dnsLookup
-      ? await dnsLookup("_mta-sts." + domain, "TXT")
-      : await dnsPromises.resolveTxt("_mta-sts." + domain);
-  } catch (e) {
-    if (e && (e.code === "ENOTFOUND" || e.code === "ENODATA")) return null;
-    throw new SmtpPolicyError("smtp/mta-sts-txt-lookup-failed",
-      "_mta-sts." + domain + " TXT lookup failed: " +
-      ((e && e.message) || String(e)));
-  }
+  // Secure DNS path — a spoofed _mta-sts TXT could downgrade mail TLS, so this
+  // must not use plaintext dnsPromises.
+  var records = await networkDnsResolver().safeResolveTxt("_mta-sts." + domain, {
+    dnsLookup:    dnsLookup,
+    errorFactory: function (code, msg) { return new SmtpPolicyError(code, msg); },
+    code:         "smtp/mta-sts-txt-lookup-failed",
+  });
   if (!Array.isArray(records)) return null;
   for (var i = 0; i < records.length; i += 1) {
     var rec = Array.isArray(records[i]) ? records[i].join("") : records[i];
@@ -577,19 +573,14 @@ async function tlsRptFetchPolicy(domain, opts) {
   }
   opts = opts || {};
   var qname = "_smtp._tls." + domain;
-  var records;
-  try {
-    if (opts.dnsLookup) {
-      records = await opts.dnsLookup(qname, "TXT");
-    } else {
-      records = await dnsPromises.resolveTxt(qname);
-    }
-  } catch (e) {
-    if (e && (e.code === "ENOTFOUND" || e.code === "ENODATA")) return null;
-    throw new SmtpPolicyError("smtp/tls-rpt-lookup-failed",
-      "TLS-RPT TXT lookup for " + qname + " failed: " +
-      ((e && e.message) || String(e)));
-  }
+  // Secure DNS path — not plaintext dnsPromises (a spoofed TLS-RPT TXT could
+  // redirect failure reports).
+  var records = await networkDnsResolver().safeResolveTxt(qname, {
+    dnsLookup:    opts.dnsLookup,
+    errorFactory: function (code, msg) { return new SmtpPolicyError(code, msg); },
+    code:         "smtp/tls-rpt-lookup-failed",
+  });
+  if (records === null) return null;
   // Pick the first record that begins with v=TLSRPTv1 per RFC 8460 §3.
   var joined = "";
   for (var i = 0; i < (records || []).length; i += 1) {
@@ -598,16 +589,13 @@ async function tlsRptFetchPolicy(domain, opts) {
     if (/^v=TLSRPTv1\b/i.test(s)) { joined = s; break; }
   }
   if (joined.length === 0) return null;
-  var parts = joined.split(";");                                                              // allow:bare-split-on-quoted-header — allow:raw-time-literal — TLS-RPT record grammar (RFC 8460 §3): `tlsrpt-record = "v=TLSRPTv1;" *(WSP) tlsrpt-rua` with token-only values; no quoted-string
+  // TLS-RPT record grammar (RFC 8460 §3): `"v=TLSRPTv1;" *(WSP) tlsrpt-rua`
+  // with token-only values, no quoted-string — the naive split is correct.
+  var pairs = structuredFields.parseTagList(joined);
   var rua = [];
-  for (var p = 0; p < parts.length; p += 1) {
-    var t = parts[p].trim();
-    var eq = t.indexOf("=");
-    if (eq === -1) continue;
-    var k = t.slice(0, eq).trim().toLowerCase();
-    var v = t.slice(eq + 1).trim();
-    if (k === "rua") {
-      var uris = v.split(",");                                                                // allow:bare-split-on-quoted-header — allow:raw-time-literal — TLS-RPT rua grammar (RFC 8460 §3): rua = tlsrpt-uri *("," tlsrpt-uri); URIs percent-encode reserved chars, no quoted-string
+  for (var p = 0; p < pairs.length; p += 1) {
+    if (pairs[p][0] === "rua") {
+      var uris = pairs[p][1].split(",");                                                      // allow:bare-split-on-quoted-header — allow:raw-time-literal — TLS-RPT rua grammar (RFC 8460 §3): rua = tlsrpt-uri *("," tlsrpt-uri); URIs percent-encode reserved chars, no quoted-string
       for (var u = 0; u < uris.length; u += 1) {
         var uri = uris[u].trim();
         if (uri.length > 0) rua.push(uri);